Update dependencies to address security vulnerabilities #322
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Co-authored-by: rvosa <[email protected]>
Copilot
AI
changed the title
[WIP] Fix dependabot alerts for project dependencies
Update dependencies to address security vulnerabilities
Dec 22, 2025
Contributor
|
@copilot there as a build error. Fix this: |
…mpatibility Co-authored-by: rvosa <[email protected]>
Contributor
Author
... Fixed in ba65b55. The issue was a type incompatibility introduced by the Spring Framework upgrade to 4.3.30.RELEASE. HibernateTemplate.findByNamedParam() now returns List instead of Collection, so I added an explicit cast to maintain API compatibility. Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Contributor
|
@copilot there is a problem building the tests. Fix this: |
Co-authored-by: rvosa <[email protected]>
Contributor
Author
... Fixed in 8b796bf. AbstractDependencyInjectionSpringContextTests was removed in Spring 4.x. Migrated AbstractServiceTest to use @RunWith(SpringJUnit4ClassRunner.class) and @ContextConfiguration annotations, matching the pattern already used in AbstractDAOTest. Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Contributor
|
@copilot there were compilation errors. It seems the API surrounding queryForInt has changed. Correct the syntax to fix these errors: |
… compatibility Co-authored-by: rvosa <[email protected]>
Contributor
Author
... Fixed in a0888a8. The Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Contributor
|
@copilot we need to take into account that the return value needs to be cast to an Integer |
Contributor
Author
The current implementation uses |
Contributor
|
@copilot there's been an error that I remember from a previous PR. Fix this: |
Co-authored-by: rvosa <[email protected]>
…nu and displaytag dependencies Co-authored-by: rvosa <[email protected]>
Contributor
Author
Fixed in e65a86a. The root cause was that Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Contributor
|
@copilot rerun the CI because there seems to be a hopefully temporary problem |
Contributor
Author
I don't have the ability to manually trigger CI reruns. However, the CI should automatically run when commits are pushed. The latest commit e65a86a that fixed the SLF4J dependency conflicts by excluding old versions from struts-menu and displaytag dependencies was just pushed, so CI should be running or will start soon. If you need to manually rerun the CI, you can:
Alternatively, pushing an empty commit with |
Contributor
|
@copilot we seem to have progressed. There is now a problem with the application context in the OAI-PMH tests. We have seen this type of error message before. Fix this: |
…ncy for Spring 4.x compatibility Co-authored-by: rvosa <[email protected]>
Contributor
Author
... Fixed in ab3b202. The ApplicationContext failure was caused by a missing Apache Velocity dependency. Spring 4.x's VelocityConfigurer requires Velocity 1.7, which was not explicitly declared in the data_provider_web POM. Added the Apache Velocity 1.7 dependency to resolve the ClassNotFoundException for CommonsLogLogChute. |
Contributor
|
@copilot we are still getting the same errors in testing the OAI-PMH. Here is a stack trace for one of the errors: Fix this. |
…mpatibility Co-authored-by: rvosa <[email protected]>
Contributor
Author
... Fixed in 49c7531. The error was caused by the Spring configuration trying to set a |
Contributor
|
@copilot we are now seeing these two errors in the OAI-PMH tests. Fix this: |
…use Hibernate's 2.7.7 Co-authored-by: rvosa <[email protected]>
Contributor
Author
... Fixed in 5359a99. The NoSuchMethodError was caused by an ANTLR version conflict - the struts 1.2.9 dependency was pulling in ANTLR 2.7.2, which is missing the |
Contributor
|
@copilot all tests pass. Mission accomplished. Update the documentation of this PR to describe what was done in a more humanly readable form. |
Contributor
Author
Updated the PR description with a comprehensive, human-readable summary organized into sections covering security updates, technical migration work, dependency conflict resolution, and test results. The documentation now clearly explains what was done and why. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
This PR successfully addresses critical security vulnerabilities by upgrading key dependencies from outdated versions to modern, secure releases. The upgrade involved migrating from Spring 3.x to Spring 4.x and Hibernate 3.x to Hibernate 5.x, which required substantial compatibility work due to breaking API changes.
Security Updates
Critical Dependency Upgrades
Technical Migration Work
Spring 3.x → 4.x Compatibility Layer
Since Spring 4.x removed several form controller base classes that the application relied on, I implemented a custom compatibility layer to maintain existing functionality:
Created Compatibility Classes:
CancellableFormController: Reimplements SimpleFormController with form binding, validation, session management, and cancel handlingAbstractWizardFormController: Provides multi-step wizard form functionalityAbstractCommandController: Handles command-based request processing with validator supportLocations:
treebase-web/src/main/java/org/cipres/treebase/web/compat/oai-pmh_data_provider/data_provider_web/src/main/java/org/cipres/treebase/web/compat/Hibernate 3.x → 5.x Migration
Configuration Updates:
org.hibernate.cache.EhCacheProvidertoorg.hibernate.cache.ehcache.EhCacheRegionFactoryFlushModewith JPA standardFlushModeTypeTB2SequenceGeneratorto useSequenceStyleGeneratorfor Hibernate 5.xCode Changes:
org.springframework.orm.hibernate3.*toorg.springframework.orm.hibernate5.*getSession()calls to usegetSessionFactory().getCurrentSession()EnvironmentTestto use Hibernate 5.xReturningWorkAPI instead of manual connection managementHibernateAccessorreferences (removed in Spring 4.x Hibernate support)Test Framework Migration
Spring Test Framework:
AbstractDependencyInjectionSpringContextTests→@RunWith(SpringJUnit4ClassRunner.class)+@ContextConfiguration+@AutowiredAbstractTransactionalSpringContextTests→@RunWith(SpringJUnit4ClassRunner.class)+@ContextConfiguration+@TransactionalJUnit 3 → 4:
suite.addTestSuite()to@RunWith(Suite.class)+@SuiteClassesTestCaseto using@Testand@BeforeannotationsqueryForInt()withqueryForObject()Dependency Conflict Resolution
SLF4J Version Conflicts:
struts-menuanddisplaytagtreebase-corein OAI-PMH module to prevent version conflictsANTLR Version Conflicts:
getLine()method)Additional Dependencies:
VelocityConfigurercompatibilityBuild and Test Results
✅ All modules build successfully
✅ All tests pass
Future Work
A migration from the compatibility layer to Spring 4.x annotation-based controllers (
@Controller,@RequestMapping,@ModelAttribute,@InitBinder) is recommended as a separate effort to eliminate technical debt and adopt modern Spring MVC patterns.Original prompt
💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.